CVE-2026-44637: saitoha libsixel integer overflow in SIXEL parser

CVE-2026-44637 · Severity: high · CVSS 7.1 · Published 2026-05-14

libsixel is a library used to encode and decode SIXEL images, a format often used to display graphics in terminal emulators and command-line tools. A vulnerability in how the library handles large image dimensions allows a specially crafted image file to corrupt the computer's memory. If a user opens a malicious image or uses a tool like img2sixel on a hostile file, it could cause the application to crash or allow an attacker to gain unauthorized control over the system.

Technologies: Saitoha Libsixel. Vendors: Saitoha.

Quick answers

Is CVE-2026-44637 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-44637 being exploited in the wild.
How severe is CVE-2026-44637?
High severity, with a CVSS score of 7.1, published 14 May 2026.
Which products and versions are affected?
Saitoha Libsixel 0.11.0 to 1.8.7-r1.
Is there a fix for CVE-2026-44637?
A patch was published on 2026-05-14: Fixed in version 1.8.7-r2 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44637 attacked?
It is attacked with local access, in a software library.
Am I affected by CVE-2026-44637?
Check whether you run Saitoha Libsixel at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A signed integer overflow exists in the SIXEL parser's image-buffer doubling loop within `sixel_decode_raw_impl`. The variable `context->pos_x` can be incremented by `repeat_count` without sufficient upper-bound checks, eventually approaching `INT_MAX`. When `pos_x + repeat_count` overflows, the subsequent buffer resize check (`sx > image->width`) can be bypassed because the wrapped value appears smaller than the current width. This results in a large attacker-influenced offset being used for a heap write at `image->data[pos]`. The vulnerability is reachable via any application using `sixel_decode_raw` or `sixel_decode`, including the `img2sixel` utility. A fix is available in version 1.8.7-r2.

Affected products

  • saitoha libsixel 0.11.0 to 1.8.7-r1

Timeline

  • 2026-05-03: advisory: GitHub Security Advisory published by maintainer
  • 2026-05-14: disclosed: CVE published to NVD
  • 2026-05-14: patched: Fixed in version 1.8.7-r2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.